xref: /freebsd/sys/netinet/libalias/libalias.3 (revision 8ddc51bc8b74b4809150b3129d16f8c63517fd84)
13efa11bbSBrian Somers.Dd July, 1997
23efa11bbSBrian Somers.Dt "libalias" 3
33efa11bbSBrian Somers.Os
43efa11bbSBrian Somers.Sh NAME
53efa11bbSBrian Somers.Nm "libalias"
63efa11bbSBrian SomersPacket Aliasing Library.  A collection of
73efa11bbSBrian Somersfunctions for aliasing and de-aliasing
83efa11bbSBrian Somersof IP packets, intended for masquerading and
93efa11bbSBrian Somersnetwork address translation (NAT).
103efa11bbSBrian Somers
113efa11bbSBrian Somers.Sh SYNOPSIS
123efa11bbSBrian Somers.Fd #include <netinet/in.h>
133efa11bbSBrian Somers.Fd #include <alias.h>
143efa11bbSBrian Somers
153efa11bbSBrian SomersFunction prototypes are given in the main body
163efa11bbSBrian Somersof the text.
173efa11bbSBrian Somers
183efa11bbSBrian Somers.Sh CONTENTS
193efa11bbSBrian Somers.Bd -literal -offset left
203efa11bbSBrian Somers1. Introduction
213efa11bbSBrian Somers2. Initialization and Control
223efa11bbSBrian Somers    2.1 PacketAliasInit()
238ddc51bcSEivind Eklund    2.2 PacketAliasUninit()
248ddc51bcSEivind Eklund    2.3 PacketAliasSetAddress()
258ddc51bcSEivind Eklund    2.4 PacketAliasSetMode()
268ddc51bcSEivind Eklund    2.5 PacketAliasSetFWBase()
273efa11bbSBrian Somers3. Packet Handling
283efa11bbSBrian Somers    3.1 PacketAliasOut()
293efa11bbSBrian Somers    3.2 PacketAliasIn()
303efa11bbSBrian Somers4. Port and Address Redirection
313efa11bbSBrian Somers    4.1 PacketAliasRedirectPort()
323efa11bbSBrian Somers    4.2 PacketAliasRedirectAddr()
333efa11bbSBrian Somers    4.3 PacketAliasRedirectDelete()
343efa11bbSBrian Somers5. Fragment Handling
353efa11bbSBrian Somers    5.1 PacketAliasSaveFragment()
363efa11bbSBrian Somers    5.2 PacketAliasGetFragment()
373efa11bbSBrian Somers    5.3 PacketAliasFragmentIn()
383efa11bbSBrian Somers6. Miscellaneous Functions
393efa11bbSBrian Somers    6.1 PacketAliasSetTarget()
403efa11bbSBrian Somers    6.2 PacketAliasCheckNewLink()
413efa11bbSBrian Somers    6.3 PacketAliasInternetChecksum()
423efa11bbSBrian Somers7. Authors
433efa11bbSBrian Somers8. Acknowledgments
443efa11bbSBrian Somers
453efa11bbSBrian SomersAppendix A: Conceptual Background
463efa11bbSBrian Somers    A.1 Aliasing Links
473efa11bbSBrian Somers    A.2 Static and Dynamic Links
483efa11bbSBrian Somers    A.3 Partially Specified Links
493efa11bbSBrian Somers    A.4 Dynamic Link Creation
503efa11bbSBrian Somers.Ed
513efa11bbSBrian Somers
523efa11bbSBrian Somers.Sh 1. Introduction
533efa11bbSBrian SomersThis library is a moderately portable
543efa11bbSBrian Somersset of functions designed to assist
553efa11bbSBrian Somersin the process of IP masquerading and
563efa11bbSBrian Somersnetwork address translation.  Outgoing
573efa11bbSBrian Somerspackets from a local network with
583efa11bbSBrian Somersunregistered IP addresses can be aliased
593efa11bbSBrian Somersto appear as if they came from an
603efa11bbSBrian Somersaccessible IP address.  Incoming packets
613efa11bbSBrian Somersare then de-aliased so that they are sent
623efa11bbSBrian Somersto the correct machine on the local network.
633efa11bbSBrian Somers
643efa11bbSBrian SomersA certain amount of flexibility is built
653efa11bbSBrian Somersinto the packet aliasing engine.  In
663efa11bbSBrian Somersthe simplest mode of operation, a
673efa11bbSBrian Somersmany-to-one address mapping takes place
683efa11bbSBrian Somersbetween local network and the packet
693efa11bbSBrian Somersaliasing host.  This is known as IP
703efa11bbSBrian Somersmasquerading.  In addition, one-to-one
713efa11bbSBrian Somersmappings between local and public addresses
723efa11bbSBrian Somerscan also be implemented, which is known as
733efa11bbSBrian Somersstatic NAT.  In between these extremes,
743efa11bbSBrian Somersdifferent groups of private addresses
753efa11bbSBrian Somerscan be linked to different public addresses,
763efa11bbSBrian Somerscomprising several distinct many-to-one
773efa11bbSBrian Somersmappings.  Also, a given public address
783efa11bbSBrian Somersand port can be staticly redirected to
793efa11bbSBrian Somersa private address/port.
803efa11bbSBrian Somers
813efa11bbSBrian SomersThe packet aliasing engine was designed
823efa11bbSBrian Somersto operate in user space outside of the
833efa11bbSBrian Somerskernel, without any access to private
843efa11bbSBrian Somerskernel data structure, but the source code
853efa11bbSBrian Somerscan also be ported to a kernel environment.
863efa11bbSBrian Somers
873efa11bbSBrian Somers.Sh 2. Initialization and Control
883efa11bbSBrian SomersTwo specific functions, PacketAliasInit()
893efa11bbSBrian Somersand PacketAliasSetAddress(), must always be
903efa11bbSBrian Somerscalled before any packet handling may be
913efa11bbSBrian Somersperformed.  In addition, the operating mode
923efa11bbSBrian Somersof the packet aliasing engine can be customized
933efa11bbSBrian Somersby calling PacketAliasSetMode().
943efa11bbSBrian Somers.Ss 2.1 PacketAliasInit()
953efa11bbSBrian Somers
963efa11bbSBrian Somers.Ft void
973efa11bbSBrian Somers.Fn PacketAliasInit "void"
983efa11bbSBrian Somers
993efa11bbSBrian SomersThis function has no argument or return
1003efa11bbSBrian Somersvalue and is used to initialize internal
1013efa11bbSBrian Somersdata structures. The following mode bits
1023efa11bbSBrian Somersare always set after calling
1033efa11bbSBrian SomersPacketAliasInit().  See section 2.3 for
1043efa11bbSBrian Somersthe meaning of these mode bits.
1053efa11bbSBrian Somers.Bd -literal -offset indent
1063efa11bbSBrian Somers    PKT_ALIAS_USE_SAME_PORTS
1073efa11bbSBrian Somers    PKT_ALIAS_USE_SOCKETS
1083efa11bbSBrian Somers    PKT_ALIAS_RESET_ON_ADDR_CHANGE
1093efa11bbSBrian Somers
1103efa11bbSBrian Somers.Ed
1113efa11bbSBrian SomersThis function will always return the packet
1123efa11bbSBrian Somersaliasing engine to the same initial state.
1133efa11bbSBrian SomersPacketAliasSetAddress() must be called afterwards,
1143efa11bbSBrian Somersand any desired changes from the default mode
1153efa11bbSBrian Somersbits listed above require a call to
1163efa11bbSBrian SomersPacketAliasSetMode().
1173efa11bbSBrian Somers
1183efa11bbSBrian SomersIt is mandatory that this function be called
1193efa11bbSBrian Somersat the beginning of a program prior to any
1203efa11bbSBrian Somerspacket handling.
1218ddc51bcSEivind Eklund.Ss 2.2 PacketAliasUnInit()
1228ddc51bcSEivind Eklund
1238ddc51bcSEivind Eklund.Ft void
1248ddc51bcSEivind Eklund.Fn PacketAliasUnInit "void"
1258ddc51bcSEivind Eklund
1268ddc51bcSEivind EklundThis function has no argument or return
1278ddc51bcSEivind Eklundvalue and is used to clear any resources
1288ddc51bcSEivind Eklundattached to internal data structures.
1298ddc51bcSEivind Eklund
1308ddc51bcSEivind EklundThis functions should be called when a
1318ddc51bcSEivind Eklundprogram stop using the aliasing engine;
1328ddc51bcSEivind Eklundit do, among other things, clear out any
1338ddc51bcSEivind Eklundfirewall holes.  To provide backwards
1348ddc51bcSEivind Eklundcompatibility and extra security, it is
1358ddc51bcSEivind Eklundadded to the atexit() chain by
1368ddc51bcSEivind EklundPacketAliasInit().  Calling it multiple
1378ddc51bcSEivind Eklundtimes is harmless.
1388ddc51bcSEivind Eklund.Ss 2.3 PacketAliasSetAddress()
1393efa11bbSBrian Somers
1403efa11bbSBrian Somers.Ft void
1413efa11bbSBrian Somers.Fn PacketAliasSetAddress "struct in_addr addr"
1423efa11bbSBrian Somers
1433efa11bbSBrian SomersThis function sets the source address to which
1443efa11bbSBrian Somersoutgoing packets from the local area network
1453efa11bbSBrian Somersare aliased.  All outgoing packets are remapped
1463efa11bbSBrian Somersto this address unless overridden by a static
1473efa11bbSBrian Somersaddress mapping established by
1483efa11bbSBrian SomersPacketAliasRedirectAddr().
1493efa11bbSBrian Somers
1503efa11bbSBrian SomersIf the PKT_ALIAS_RESET_ON_ADDR_CHANGE mode bit
1513efa11bbSBrian Somersis set (the default mode of operation), then
1523efa11bbSBrian Somersthe internal aliasing link tables will be reset
1533efa11bbSBrian Somersany time the aliasing address changes, as if
1543efa11bbSBrian SomersPacketAliasReset() were called.  This is useful
1553efa11bbSBrian Somersfor interfaces such as ppp where the IP
1563efa11bbSBrian Somersaddress may or may not change on successive
1573efa11bbSBrian Somersdial-up attempts.
1583efa11bbSBrian Somers
1593efa11bbSBrian SomersIf the PKT_ALIAS_RESET_ON_ADDR_CHANGE mode bit
1603efa11bbSBrian Somersis set to zero, this function can also be used to
1613efa11bbSBrian Somersdynamically change the aliasing address on a
1623efa11bbSBrian Somerspacket to packet basis (it is a low overhead
1633efa11bbSBrian Somerscall).
1643efa11bbSBrian Somers
1653efa11bbSBrian SomersIt is mandatory that this function be called
1663efa11bbSBrian Somersprior to any packet handling.
1678ddc51bcSEivind Eklund.Ss 2.4 PacketAliasSetMode()
1683efa11bbSBrian Somers
1693efa11bbSBrian Somers.Ft void
1703efa11bbSBrian Somers.Fn PacketAliasSetMode "int mode" "int mask"
1713efa11bbSBrian Somers
1723efa11bbSBrian SomersThis function sets or clears mode bits
1733efa11bbSBrian Somersaccording to the value of
1743efa11bbSBrian Somers.Em mode .
1753efa11bbSBrian SomersOnly bits marked in
1763efa11bbSBrian Somers.Em mask
1773efa11bbSBrian Somersare affected.  The following mode bits are
1783efa11bbSBrian Somersdefined in alias.h:
1793efa11bbSBrian Somers.Bl -hang -offset left
1803efa11bbSBrian Somers.It PKT_ALIAS_LOG.
1813efa11bbSBrian SomersEnables logging /var/log/alias.log.  The log file
1823efa11bbSBrian Somersshows total numbers of links (icmp, tcp, udp) each
1833efa11bbSBrian Somerstime an aliasing link is created or deleted.  Mainly
1843efa11bbSBrian Somersuseful for debugging when the log file is viewed
1853efa11bbSBrian Somerscontinuously with "tail -f".
1863efa11bbSBrian Somers.It PKT_ALIAS_DENY_INCOMING.
1873efa11bbSBrian SomersIf this mode bit is set, all incoming packets
1883efa11bbSBrian Somersassociated with new TCP connections or new
1893efa11bbSBrian SomersUDP transactions will be marked for being
1903efa11bbSBrian Somersignored (PacketAliasIn() return code
1913efa11bbSBrian SomersPKT_ALIAS_IGNORED) by the calling program.
1923efa11bbSBrian SomersResponse packets to connections or transactions
1933efa11bbSBrian Somersinitiated from the packet aliasing host or
1943efa11bbSBrian Somerslocal network will be unaffected.  This mode
1953efa11bbSBrian Somersbit is useful for implementing a one-way firewall.
1963efa11bbSBrian Somers.It PKT_ALIAS_SAME_PORTS.
1973efa11bbSBrian SomersIf this mode bit is set, the packet aliasing
1983efa11bbSBrian Somersengine will attempt to leave the alias port
1993efa11bbSBrian Somersnumbers unchanged from the actual local port
2003efa11bbSBrian Somersnumber.  This can be done as long as the
2013efa11bbSBrian Somersquintuple (proto, alias addr, alias port,
2023efa11bbSBrian Somersremote addr, remote port) is unique.  If a
2033efa11bbSBrian Somersconflict exists, an new aliasing port number is
2043efa11bbSBrian Somerschosen even if this mode bit is set.
2053efa11bbSBrian Somers.It PKT_ALIAS_USE_SOCKETS.
2063efa11bbSBrian SomersThis bit should be set when the the packet
2073efa11bbSBrian Somersaliasing host originates network traffic as
2083efa11bbSBrian Somerswell as forwards it.  When the packet aliasing
2093efa11bbSBrian Somershost is waiting for a connection from an
2103efa11bbSBrian Somersunknown host address or unknown port number
2113efa11bbSBrian Somers(e.g. an FTP data connection), this mode bit
2123efa11bbSBrian Somersspecifies that a socket be allocated as a place
2133efa11bbSBrian Somersholder to prevent port conflicts.  Once a
2143efa11bbSBrian Somersconnection is extablished, usually within a
2153efa11bbSBrian Somersminute or so, the socket is closed.
2163efa11bbSBrian Somers.It PKT_ALIAS_UNREGISTERED_ONLY.
2173efa11bbSBrian SomersIf this mode bit is set, traffic on the
2183efa11bbSBrian Somerslocal network which does not originate from
2193efa11bbSBrian Somersunregistered address spaces will be ignored.
2203efa11bbSBrian SomersStandard Class A, B and C unregistered addresses
2213efa11bbSBrian Somersare:
2223efa11bbSBrian Somers.Bd -literal -offset indent
2233efa11bbSBrian Somers    10.0.0.0     ->   10.255.255.255   (Class A subnet)
2243efa11bbSBrian Somers    172.16.0.0   ->   172.31.255.255   (Class B subnets)
2253efa11bbSBrian Somers    192.168.0.0  ->   192.168.255.255  (Class C subnets)
2263efa11bbSBrian Somers
2273efa11bbSBrian Somers.Ed
2283efa11bbSBrian SomersThis option is useful in the case that
2293efa11bbSBrian Somerspacket aliasing host has both registered and
2303efa11bbSBrian Somersunregistered subnets on different interfaces.
2313efa11bbSBrian SomersThe registered subnet is fully accessible to
2323efa11bbSBrian Somersthe outside world, so traffic from it doesn't
2333efa11bbSBrian Somersneed to be passed through the packet aliasing
2343efa11bbSBrian Somersengine.
2353efa11bbSBrian Somers.It PKT_ALIAS_RESET_ON_ADDR_CHANGE.
2363efa11bbSBrian SomersWhen this mode bit is set and
2373efa11bbSBrian SomersPacketAliasSetAddress() is called to change
2383efa11bbSBrian Somersthe aliasing address, the internal link table
2393efa11bbSBrian Somersof the packet aliasing engine will be cleared.
2403efa11bbSBrian SomersThis operating mode is useful for ppp links
2413efa11bbSBrian Somerswhere the interface address can sometimes
2423efa11bbSBrian Somerschange or remain the same between dial-ups.
2433efa11bbSBrian SomersIf this mode bit is not set, it the link table
2443efa11bbSBrian Somerswill never be reset in the event of an
2453efa11bbSBrian Somersaddress change.
2468ddc51bcSEivind Eklund.It PKT_ALIAS_PUNCH_FW.
2478ddc51bcSEivind EklundThis option make libalias `punch holes' in an
2488ddc51bcSEivind Eklundipfw based firewall for FTP/IRC DCC connections.
2498ddc51bcSEivind EklundThe holes punched are bound by from/to IP address
2508ddc51bcSEivind Eklundand port; it will not be possible to use a hole
2518ddc51bcSEivind Eklundfor another connection.  A hole is removed when
2528ddc51bcSEivind Eklundthe connection that use it die.  To cater for
2538ddc51bcSEivind Eklundunexpected death of a program using libalias (e.g
2548ddc51bcSEivind Eklundkill -9), changing the state of the flag will
2558ddc51bcSEivind Eklundclear the entire ipfw range allocated for holes.
2568ddc51bcSEivind EklundThis will also happen on the initial call to
2578ddc51bcSEivind EklundPacketAliasSetFWBase().  This call must happen
2588ddc51bcSEivind Eklundprior to setting this flag.
2598ddc51bcSEivind Eklund
2603efa11bbSBrian Somers.El
2618ddc51bcSEivind Eklund
2628ddc51bcSEivind Eklund.Ss 2.5 PacketAliasSetFWBase()
2638ddc51bcSEivind Eklund
2648ddc51bcSEivind Eklund.Ft void
2658ddc51bcSEivind Eklund.Fn PacketAliasSetFWBase "unsigned int base" "unsigned int num"
2668ddc51bcSEivind Eklund
2678ddc51bcSEivind EklundSet IPFW range allocated for punching firewall holes (with the
2688ddc51bcSEivind EklundPKT_ALIAS_PUNCH_FW flag).  The range will be cleared for all rules on
2698ddc51bcSEivind Eklundinitialization.
2708ddc51bcSEivind Eklund
2713efa11bbSBrian Somers.Sh 3. Packet Handling
2723efa11bbSBrian SomersThe packet handling functions are used to
2733efa11bbSBrian Somersmodify incoming (remote->local) and outgoing
2743efa11bbSBrian Somers(local->remote) packets.  The calling program
2753efa11bbSBrian Somersis responsible for receiving and sending
2763efa11bbSBrian Somerspackets via network interfaces.
2773efa11bbSBrian Somers
2783efa11bbSBrian SomersAlong with PacketAliasInit() and PacketAliasSetAddress(),
2793efa11bbSBrian Somersthe two packet handling functions, PacketAliasIn()
2803efa11bbSBrian Somersand PacketAliasOut(), comprise minimal set of functions
2813efa11bbSBrian Somersneeded for a basic IP masquerading implementation.
2823efa11bbSBrian Somers.Ss 3.1 PacketAliasIn()
2833efa11bbSBrian Somers
2843efa11bbSBrian Somers.Ft int
2853efa11bbSBrian Somers.Fn PacketAliasIn "char *buffer" "int maxpacketsize"
2863efa11bbSBrian Somers
2873efa11bbSBrian SomersAn incoming packet coming from a remote machine to
2883efa11bbSBrian Somersthe local network is de-aliased by this function.
2893efa11bbSBrian SomersThe IP packet is pointed to by
2903efa11bbSBrian Somers.Em buffer ,
2913efa11bbSBrian Somersand
2923efa11bbSBrian Somers.Em maxpacketsize
2933efa11bbSBrian Somersindicates the size of the data structure containing
2943efa11bbSBrian Somersthe packet and should be at least as large as the
2953efa11bbSBrian Somersactual packet size.
2963efa11bbSBrian Somers
2973efa11bbSBrian SomersReturn codes:
2983efa11bbSBrian Somers.Bl -hang -offset left
2993efa11bbSBrian Somers.It PKT_ALIAS_ERROR.
3003efa11bbSBrian SomersAn internal error within the packet aliasing
3013efa11bbSBrian Somersengine occured.
3023efa11bbSBrian Somers.It PKT_ALIAS_OK.
3033efa11bbSBrian SomersThe packet aliasing process was successful.
3043efa11bbSBrian Somers.It PKT_ALIAS_IGNORED.
3053efa11bbSBrian SomersThe packet was ignored and not de-aliased.
3063efa11bbSBrian SomersThis can happen if the protocal is unrecognized,
3073efa11bbSBrian Somerspossibly an ICMP message type is not handled or
3083efa11bbSBrian Somersif incoming packets for new connections are being
3093efa11bbSBrian Somersignored (see PKT_ALIAS_DENY_INCOMING in section
3103efa11bbSBrian Somers2.2).
3113efa11bbSBrian Somers.It PKT_ALIAS_UNRESOLVED_FRAGMENT.
3123efa11bbSBrian SomersThis is returned when a fragment cannot be
3133efa11bbSBrian Somersresolved because the header fragment has not
3143efa11bbSBrian Somersbeen sent yet.  In this situation, fragments
3153efa11bbSBrian Somersmust be saved with PacketAliasSaveFragment()
3163efa11bbSBrian Somersuntil a header fragment is found.
3173efa11bbSBrian Somers.It PKT_ALIAS_FOUND_HEADER_FRAGMENT.
3183efa11bbSBrian SomersThe packet aliasing process was successful,
3193efa11bbSBrian Somersand a header fragment was found.  This is a
3203efa11bbSBrian Somerssignal to retrieve any unresolved fragments
3213efa11bbSBrian Somerswith PacketAliasGetFragment() and de-alias
3223efa11bbSBrian Somersthem with PacketAliasFragmentIn().
3233efa11bbSBrian Somers.El
3243efa11bbSBrian Somers.Ss 3.2 PacketAliasOut()
3253efa11bbSBrian Somers
3263efa11bbSBrian Somers.Ft int
3273efa11bbSBrian Somers.Fn PacketAliasIn "char *buffer" "int maxpacketsize"
3283efa11bbSBrian Somers
3293efa11bbSBrian SomersAn outgoing packet coming from the local network
3303efa11bbSBrian Somersto a remote machine is aliased by this function.
3313efa11bbSBrian SomersThe IP packet is pointed to by
3323efa11bbSBrian Somers.Em buffer r,
3333efa11bbSBrian Somersand
3343efa11bbSBrian Somers.Em maxpacketsize
3353efa11bbSBrian Somersindicates the maximum packet size permissable
3363efa11bbSBrian Somersshould the packet length be changed.  IP encoding
3373efa11bbSBrian Somersprotocols place addresss and port information in
3383efa11bbSBrian Somersthe encapsulated data stream which have to be
3393efa11bbSBrian Somersmodified and can account for changes in packet
3403efa11bbSBrian Somerslength.  Well known examples of such protocols
3418ddc51bcSEivind Eklundare FTP and IRC DCC.
3423efa11bbSBrian Somers
3433efa11bbSBrian SomersReturn codes:
3443efa11bbSBrian Somers.Bl -hang -offset left
3453efa11bbSBrian Somers.It PKT_ALIAS_ERROR.
3463efa11bbSBrian SomersAn internal error within the packet aliasing
3473efa11bbSBrian Somersengine occured.
3483efa11bbSBrian Somers.It PKT_ALIAS_OK.
3493efa11bbSBrian SomersThe packet aliasing process was successful.
3503efa11bbSBrian Somers.It PKT_ALIAS_IGNORED.
3513efa11bbSBrian SomersThe packet was ignored and not de-aliased.
3523efa11bbSBrian SomersThis can happen if the protocal is unrecognized,
3533efa11bbSBrian Somersor possibly an ICMP message type is not handled.
3543efa11bbSBrian Somers.El
3553efa11bbSBrian Somers
3563efa11bbSBrian Somers.Sh 4. Port and Address Redirection
3573efa11bbSBrian SomersThe functions described in this section allow machines
3583efa11bbSBrian Somerson the local network to be accessible in some degree
3593efa11bbSBrian Somersto new incoming connections from the external network.
3603efa11bbSBrian SomersIndividual ports can be re-mapped or static network
3613efa11bbSBrian Somersaddress translations can be designated.
3623efa11bbSBrian Somers.Ss 4.1 PacketAliasRedirectPort()
3633efa11bbSBrian Somers
3643efa11bbSBrian Somers.Ft struct alias_link *
3653efa11bbSBrian Somers.Fo PacketAliasRedirectPort
3663efa11bbSBrian Somers.Fa "struct in_addr local_addr"
3673efa11bbSBrian Somers.Fa "u_short local_port"
3683efa11bbSBrian Somers.Fa "struct in_addr remote_addr"
3693efa11bbSBrian Somers.Fa "u_short remote_port"
3703efa11bbSBrian Somers.Fa "struct in_addr alias_addr"
3713efa11bbSBrian Somers.Fa "u_short alias_port"
3723efa11bbSBrian Somers.Fa "u_char proto"
3733efa11bbSBrian Somers.Fc
3743efa11bbSBrian Somers
3753efa11bbSBrian SomersThis function specifies that traffic from a
3763efa11bbSBrian Somersgiven remote address/port to an alias address/port
3773efa11bbSBrian Somersbe redirected to a specified local address/port.
3783efa11bbSBrian SomersThe paramater
3793efa11bbSBrian Somers.Em proto
3803efa11bbSBrian Somerscan be either IPPROTO_TCP or IPPROTO_UDP, as
3813efa11bbSBrian Somersdefined in <netinet/in.h>.
3823efa11bbSBrian Somers
3833efa11bbSBrian SomersIf
3843efa11bbSBrian Somers.Em local_addr
3853efa11bbSBrian Somersor
3863efa11bbSBrian Somers.Em alias_addr
3873efa11bbSBrian Somersis zero, this indicates that the packet aliasing
3883efa11bbSBrian Somersaddress as established by PacketAliasSetAddress()
3893efa11bbSBrian Somersis to be used.  Even if PacketAliasAddress() is
3903efa11bbSBrian Somerscalled to change the address after PacketAliasRedirectPort()
3913efa11bbSBrian Somersis called, a zero reference will track this change.
3923efa11bbSBrian Somers
3933efa11bbSBrian SomersIf
3943efa11bbSBrian Somers.Em remote_addr
3953efa11bbSBrian Somersis zero, this indicates to redirect packets from
3963efa11bbSBrian Somersany remote address.  Likewise, if
3973efa11bbSBrian Somers.Em remote_port
3983efa11bbSBrian Somersis zero, this indicates to redirect packets originating
3993efa11bbSBrian Somersfrom any remote port number.  Almost always, the remote
4003efa11bbSBrian Somersport specification will be zero, but non-zero remote
4013efa11bbSBrian Somersaddresses can be sometimes be useful for firewalling.
4023efa11bbSBrian SomersIf two calls to PacketAliasRedirectPort() overlap in
4033efa11bbSBrian Somerstheir address/port specifications, then the most recent
4043efa11bbSBrian Somerscall will have precedence.
4053efa11bbSBrian Somers
4063efa11bbSBrian SomersThis function returns a pointer which can subsequently
4073efa11bbSBrian Somersbe used by PacketAliasRedirectDelete().  If NULL is
4083efa11bbSBrian Somersreturned, then the function call did not complete
4093efa11bbSBrian Somerssuccessfully.
4103efa11bbSBrian Somers
4113efa11bbSBrian SomersAll port numbers are in network address byte order,
4123efa11bbSBrian Somersso it is necessary to use htons() to convert these
4133efa11bbSBrian Somersparameters from internally readable numbers to
4143efa11bbSBrian Somersnetwork byte order.  Addresses are also in network
4153efa11bbSBrian Somersbyte order, which is implicit in the use of the
4163efa11bbSBrian Somers.Em struct in_addr
4173efa11bbSBrian Somersdata type.
4183efa11bbSBrian Somers.Ss 4.2 PacketAliasRedirectAddr()
4193efa11bbSBrian Somers
4203efa11bbSBrian Somers.Ft struct alias_link *
4213efa11bbSBrian Somers.Fo PacketAliasRedirectAddress
4223efa11bbSBrian Somers.Fa "struct in_addr local_addr"
4233efa11bbSBrian Somers.Fa "struct in_addr alias_addr"
4243efa11bbSBrian Somers.Fc
4253efa11bbSBrian Somers
4263efa11bbSBrian SomersThis function desgnates that all incoming
4273efa11bbSBrian Somerstraffic to
4283efa11bbSBrian Somers.Em alias_addr
4293efa11bbSBrian Somersbe redirected to
4303efa11bbSBrian Somers.Em local_addr.
4313efa11bbSBrian SomersSimilarly, all outgoing traffic from
4323efa11bbSBrian Somers.Em local_addr
4333efa11bbSBrian Somersis aliased to
4343efa11bbSBrian Somers.Em alias_addr .
4353efa11bbSBrian Somers
4363efa11bbSBrian SomersIf
4373efa11bbSBrian Somers.Em local_addr
4383efa11bbSBrian Somersor
4393efa11bbSBrian Somers.Em alias_addr
4403efa11bbSBrian Somersis zero, this indicates that the packet aliasing
4413efa11bbSBrian Somersaddress as established by PacketAliasSetAddress()
4423efa11bbSBrian Somersis to be used.  Even if PacketAliasAddress() is
4433efa11bbSBrian Somerscalled to change the address after PacketAliasRedirectAddr()
4443efa11bbSBrian Somersis called, a zero reference will track this change.
4453efa11bbSBrian Somers
4463efa11bbSBrian SomersIf subsequent calls to PacketAliasRedirectAddr()
4473efa11bbSBrian Somersuse the same aliasing address, all new incoming
4483efa11bbSBrian Somerstraffic to this aliasing address will be redirected
4493efa11bbSBrian Somersto the local address made in the last function call,
4503efa11bbSBrian Somersbut new traffic all of the local machines designated
4513efa11bbSBrian Somersin the several function calls will be aliased to
4523efa11bbSBrian Somersthe same address.  Consider the following example:
4533efa11bbSBrian Somers.Bd -literal -offset left
4543efa11bbSBrian Somers    PacketAliasRedirectAddr(inet_aton("192.168.0.2"),
4553efa11bbSBrian Somers                            inet_aton("141.221.254.101"));
4563efa11bbSBrian Somers    PacketAliasRedirectAddr(inet_aton("192.168.0.3"),
4573efa11bbSBrian Somers                            inet_aton("141.221.254.101"));
4583efa11bbSBrian Somers    PacketAliasRedirectAddr(inet_aton("192.168.0.4"),
4593efa11bbSBrian Somers                            inet_aton("141.221.254.101"));
4603efa11bbSBrian Somers.Ed
4613efa11bbSBrian Somers
4623efa11bbSBrian SomersAny outgoing connections such as telnet or ftp
4633efa11bbSBrian Somersfrom 192.168.0.2, 102.168.0.3, 192.168.0.4 will
4643efa11bbSBrian Somersappear to come from 141.221.254.101.  Any incoming
4653efa11bbSBrian Somersconnections to 141.221.254.101 will be directed
4663efa11bbSBrian Somersto 192.168.0.4.
4673efa11bbSBrian Somers
4683efa11bbSBrian SomersAny calls to PacketAliasRedirectPort() will
4693efa11bbSBrian Somershave precedence over address mappings designated
4703efa11bbSBrian Somersby PacketAliasRedirectAddr().
4713efa11bbSBrian Somers
4723efa11bbSBrian SomersThis function returns a pointer which can subsequently
4733efa11bbSBrian Somersbe used by PacketAliasRedirectDelete().  If NULL is
4743efa11bbSBrian Somersreturned, then the function call did not complete
4753efa11bbSBrian Somerssuccessfully.
4763efa11bbSBrian Somers.Ss 4.3 PacketAliasRedirectDelete()
4773efa11bbSBrian Somers
4783efa11bbSBrian Somers.Ft void
4793efa11bbSBrian Somers.Fn PacketAliasRedirectDelete "struct alias_link *ptr"
4803efa11bbSBrian Somers
4813efa11bbSBrian SomersThis function will delete a specific static redirect
4823efa11bbSBrian Somersrule entered by PacketAliasRedirectPort() or
4833efa11bbSBrian SomersPacketAliasRedirectAddr().  The parameter
4843efa11bbSBrian Somers.Em ptr
4853efa11bbSBrian Somersis the pointer returned by either of the redirection
4863efa11bbSBrian Somersfunctions.  If an invalid pointer is passed to
4873efa11bbSBrian SomersPacketAliasRedirectDelete(), then a program crash
4883efa11bbSBrian Somersor unpredictable operation could result, so it is
4893efa11bbSBrian Somersnecessary to be careful using this function.
4903efa11bbSBrian Somers
4913efa11bbSBrian Somers.Sh 5. Fragment Handling
4923efa11bbSBrian SomersThe functions in this section are used to deal with
4933efa11bbSBrian Somersincoming fragments.
4943efa11bbSBrian Somers
4953efa11bbSBrian SomersOutgoing fragments are handled within PacketAliasOut()
4963efa11bbSBrian Somersby changing the address according to any
4973efa11bbSBrian Somersapplicable mapping set by PacketAliasRedirectAddress(),
4983efa11bbSBrian Somersor the default aliasing address set by
4993efa11bbSBrian SomersPacketAliasSetAddress().
5003efa11bbSBrian Somers
5013efa11bbSBrian SomersIncoming fragments are handled in one of two ways.
5023efa11bbSBrian SomersIf the header of a fragmented IP packet has already
5033efa11bbSBrian Somersbeen seen, then all subsequent fragments will be
5043efa11bbSBrian Somersre-mapped in the same manner the header fragment
5053efa11bbSBrian Somerswas.  Fragments which arrive before the header
5063efa11bbSBrian Somersare saved and then retrieved once the header fragment
5073efa11bbSBrian Somershas been resolved.
5083efa11bbSBrian Somers.Ss 5.1 PacketAliasSaveFragment()
5093efa11bbSBrian Somers
5103efa11bbSBrian Somers.Ft int
5113efa11bbSBrian Somers.Fn PacketAliasSaveFragment "char *ptr"
5123efa11bbSBrian Somers
5133efa11bbSBrian SomersWhen PacketAliasIn() returns
5143efa11bbSBrian SomersPKT_ALIAS_UNRESOLVED_FRAGMENT, this
5153efa11bbSBrian Somersfunction can be used to save the pointer to
5163efa11bbSBrian Somersthe unresolved fragment.
5173efa11bbSBrian Somers
5183efa11bbSBrian SomersIt is implicitly assumed that
5193efa11bbSBrian Somers.Em ptr
5203efa11bbSBrian Somerspoints to a block of memory allocated by
5213efa11bbSBrian Somersmalloc().  If the fragment is never
5223efa11bbSBrian Somersresolved, the packet aliasing engine will
5233efa11bbSBrian Somersautomatically free the memory after a
5243efa11bbSBrian Somerstimeout period. [Eventually this function
5253efa11bbSBrian Somersshould be modified so that a callback
5263efa11bbSBrian Somersfunction for freeing memory is passed as
5273efa11bbSBrian Somersan argument.]
5283efa11bbSBrian Somers
5293efa11bbSBrian SomersThis function returns PKT_ALIAS_OK if it
5303efa11bbSBrian Somerswas successful and PKT_ALIAS_ERROR if there
5313efa11bbSBrian Somerswas an error.
5323efa11bbSBrian Somers.Ss 5.2 PacketAliasGetNextFragment()
5333efa11bbSBrian Somers
5343efa11bbSBrian Somers.Ft char *
5353efa11bbSBrian Somers.Fn PacketAliasGetFragment "char *buffer"
5363efa11bbSBrian Somers
5373efa11bbSBrian SomersThis function can be used to retrieve fragment
5383efa11bbSBrian Somerspointers saved by PacketAliasSaveFragment().
5393efa11bbSBrian SomersThe IP header fragment pointed to by
5403efa11bbSBrian SomersEm buffer
5413efa11bbSBrian Somersis the header fragment indicated when
5423efa11bbSBrian SomersPacketAliasIn() returns PKT_ALIAS_FOUND_HEADER_FRAGMENT.
5433efa11bbSBrian SomersOnce a a fragment pointer is retrieved, it
5443efa11bbSBrian Somersbecomes the calling program's responsibility
5453efa11bbSBrian Somersto free the dynamically allocated memory for
5463efa11bbSBrian Somersthe fragment.
5473efa11bbSBrian Somers
5483efa11bbSBrian SomersPacketAliasGetFragment() can be called
5493efa11bbSBrian Somerssequentially until there are no more fragments
5503efa11bbSBrian Somersavailable, at which time it returns NULL.
5513efa11bbSBrian Somers.Ss 5.3 PacketAliasFragmentIn()
5523efa11bbSBrian Somers
5533efa11bbSBrian Somers.Ft void
5543efa11bbSBrian Somers.Fn PacketAliasFragmentIn "char *header" "char *fragment"
5553efa11bbSBrian Somers
5563efa11bbSBrian SomersWhen a fragment is retrieved with
5573efa11bbSBrian SomersPacketAliasGetFragment(), it can then be
5583efa11bbSBrian Somersde-aliased with a call to PacketAliasFragmentIn().
5593efa11bbSBrian Somers.Em header
5603efa11bbSBrian Somersis the pointer to a header fragment used as a
5613efa11bbSBrian Somerstemplate, and
5623efa11bbSBrian Somers.Em fragment
5633efa11bbSBrian Somersis the pointer to the packet to be de-aliased.
5643efa11bbSBrian Somers
5653efa11bbSBrian Somers.Sh 6. Miscellaneous Functions
5663efa11bbSBrian Somers
5673efa11bbSBrian Somers.Ss 6.1 PacketAliasSetTarget()
5683efa11bbSBrian Somers
5693efa11bbSBrian Somers.Ft void
5703efa11bbSBrian Somers.Fn PacketAliasSetTarget "struct in_addr addr"
5713efa11bbSBrian Somers
5723efa11bbSBrian SomersWhen an incoming packet not associated with
5733efa11bbSBrian Somersany pre-existing aliasing link arrives at the
5743efa11bbSBrian Somershost machine, it will be sent to the address
5753efa11bbSBrian Somersindicated by a call to PacketAliasSetTarget().
5763efa11bbSBrian Somers
5773efa11bbSBrian SomersIf this function is not called, or is called
5783efa11bbSBrian Somerswith a zero address argument, then all new
5793efa11bbSBrian Somersincoming packets go to the address set by
5803efa11bbSBrian SomersPacketAliasSetAddress.
5813efa11bbSBrian Somers.Ss 6.2 PacketAliasCheckNewLink()
5823efa11bbSBrian Somers
5833efa11bbSBrian Somers.Ft int
5843efa11bbSBrian Somers.Fn PacketAliasCheckNewLink "void"
5853efa11bbSBrian Somers
5863efa11bbSBrian SomersThis function returns a non-zero value when
5873efa11bbSBrian Somersa new aliasing link is created.  In circumstances
5883efa11bbSBrian Somerswhere incoming traffic is being sequentially
5893efa11bbSBrian Somerssent to different local servers, this function
5903efa11bbSBrian Somerscan be used to trigger when PacketAliasSetTarget()
5913efa11bbSBrian Somersis called to change the default target address.
5923efa11bbSBrian Somers.Ss 6.3 PacketAliasInternetChecksum()
5933efa11bbSBrian Somers
5943efa11bbSBrian Somers.Ft u_short
5953efa11bbSBrian Somers.Fn PacketAliasInternetChecksum "char *buffer" "int nbytes"
5963efa11bbSBrian Somers
5973efa11bbSBrian SomersThis is a utility function that does not seem
5983efa11bbSBrian Somersto be available elswhere and is included as a
5993efa11bbSBrian Somersconvenience.  It computes the internet checksum,
6003efa11bbSBrian Somerswhich is used in both IP and protocol-specific
6013efa11bbSBrian Somersheaders (TCP, UDP, ICMP).
6023efa11bbSBrian Somers
6033efa11bbSBrian Somers.Em buffer
6043efa11bbSBrian Somerspoints to the data block to be checksummed, and
6053efa11bbSBrian Somers.Em nbytes
6063efa11bbSBrian Somersis the number of bytes.  The 16-bit checksum
6073efa11bbSBrian Somersfield should be zeroed before computing the checksum.
6083efa11bbSBrian Somers
6093efa11bbSBrian SomersChecksums can also be verified by operating on a block
6103efa11bbSBrian Somersof data including its checksum.  If the checksum is
6113efa11bbSBrian Somersvalid, PacketAliasInternetChecksum() will return zero.
6123efa11bbSBrian Somers
6133efa11bbSBrian Somers.Sh 7. Authors
61459354a4eSBrian SomersCharles Mott (cmott@srv.net), versions 1.0 - 1.8, 2.0 - 2.4.
6153efa11bbSBrian Somers
6168ddc51bcSEivind EklundEivind Eklund (eivind@freebsd.org), versions 1.8b, 1.9 and
6178ddc51bcSEivind Eklund2.5.  Added IRC DCC support as well as contributing a number of
6188ddc51bcSEivind Eklundarchitectural improvements; added the firewall bypass
6198ddc51bcSEivind Eklundfor FTP/IRC DCC.
6203efa11bbSBrian Somers
6213efa11bbSBrian Somers.Sh 8. Acknowledgments
6223efa11bbSBrian Somers
6233efa11bbSBrian SomersListed below, in approximate chronological
6243efa11bbSBrian Somersorder, are individuals who have provided
6253efa11bbSBrian Somersvaluable comments and/or debugging assistance.
6263efa11bbSBrian Somers
6273efa11bbSBrian Somers.Bl -inset -compact -offset left
6283efa11bbSBrian Somers.It Gary Roberts
6293efa11bbSBrian Somers.It Tom Torrance
6303efa11bbSBrian Somers.It Reto Burkhalter
6313efa11bbSBrian Somers.It Martin Renters
6323efa11bbSBrian Somers.It Brian Somers
6333efa11bbSBrian Somers.It Paul Traina
6343efa11bbSBrian Somers.It Ari Suutari
6353efa11bbSBrian Somers.It Dave Remien
6363efa11bbSBrian Somers.It J. Fortes
6373efa11bbSBrian Somers.It Andrzej Bialeki
6384fe071a9SBrian Somers.It Gordon Burditt
6393efa11bbSBrian Somers.El
6403efa11bbSBrian Somers
6413efa11bbSBrian Somers.Sh Appendix: Conceptual Background
6423efa11bbSBrian SomersThis appendix is intended for those who
6433efa11bbSBrian Somersare planning to modify the source code or want
6443efa11bbSBrian Somersto create somewhat esoteric applications using
6453efa11bbSBrian Somersthe packet aliasing functions.
6463efa11bbSBrian Somers
6473efa11bbSBrian SomersThe conceptual framework under which the
6483efa11bbSBrian Somerspacket aliasing engine operates is described here.
6493efa11bbSBrian SomersCentral to the discussion is the idea of an
6503efa11bbSBrian Somers"aliasing link" which  describes the relationship
6513efa11bbSBrian Somersfor a given packet transaction between the local
6523efa11bbSBrian Somersmachine, aliased identity and remote machine.  It
6533efa11bbSBrian Somersis discussed how such links come into existence
6543efa11bbSBrian Somersand are destroyed.
6553efa11bbSBrian Somers.Ss A.1 Aliasing Links
6563efa11bbSBrian SomersThere is a notion of an "aliasing link",
6573efa11bbSBrian Somerswhich is 7-tuple describing a specific
6583efa11bbSBrian Somerstranslation:
6593efa11bbSBrian Somers.Bd -literal -offset indent
6603efa11bbSBrian Somers(local addr, local port, alias addr, alias port,
6613efa11bbSBrian Somers remote addr, remote port, protocol)
6623efa11bbSBrian Somers.Ed
6633efa11bbSBrian Somers
6643efa11bbSBrian SomersOutgoing packets have the local address and
6653efa11bbSBrian Somersport number replaced with the alias address
6663efa11bbSBrian Somersand port number.  Incoming packets undergo the
6673efa11bbSBrian Somersreverse process.  The packet aliasing engine
6683efa11bbSBrian Somersattempts to match packets against an internal
6693efa11bbSBrian Somerstable of aliasing links to determine how to
6703efa11bbSBrian Somersmodify a given IP packet.  Both the IP
6713efa11bbSBrian Somersheader and protocol dependent headers are
6723efa11bbSBrian Somersmodified as necessary.  Aliasing links are
6733efa11bbSBrian Somerscreated and deleted as necessary according
6743efa11bbSBrian Somersto network traffic.
6753efa11bbSBrian Somers
6763efa11bbSBrian SomersProtocols can be TCP, UDP or even ICMP in
6773efa11bbSBrian Somerscertain circumstances.  (Some types of ICMP
6783efa11bbSBrian Somerspackets can be aliased according to sequence
6793efa11bbSBrian Somersor id number which acts as an equivalent port
6803efa11bbSBrian Somersnumber for identifying how individual packets
6813efa11bbSBrian Somersshould be handled.)
6823efa11bbSBrian Somers
6833efa11bbSBrian SomersEach aliasing link must have a unique
6843efa11bbSBrian Somerscombination of the following five quanties:
6853efa11bbSBrian Somersalias address/port, remote address/port
6863efa11bbSBrian Somersand protocol.  This ensures that several
6873efa11bbSBrian Somersmachines on a local network can share the
6883efa11bbSBrian Somerssame aliased IP address.  In cases where
6893efa11bbSBrian Somersconflicts might arise, the aliasing port
6903efa11bbSBrian Somersis chosen so that uniqueness is maintained.
6913efa11bbSBrian Somers.Ss A.2 Static and Dynamic Links
6923efa11bbSBrian SomersAliasing links can either be static or dynamic.
6933efa11bbSBrian SomersStatic links persist indefinitely and represent
6943efa11bbSBrian Somersfixed rules for translating IP packets.  Dynamic
6953efa11bbSBrian Somerslinks come into existence for a specific TCP
6963efa11bbSBrian Somersconnection or UDP transaction or ICMP echo
6973efa11bbSBrian Somerssequence.  For the case of TCP, the connection
6983efa11bbSBrian Somerscan be monitored to see when the associated
6993efa11bbSBrian Somersaliasing link should be deleted.  Aliasing links
7003efa11bbSBrian Somersfor UDP transactions (and ICMP echo and timestamp
7013efa11bbSBrian Somersequests) work on a simple timeout rule.  When
7023efa11bbSBrian Somersno activity is observed on a dynamic link for
7033efa11bbSBrian Somersa certain amount of time it is automatically
7043efa11bbSBrian Somersdeleted.  Timeout rules also apply to TCP
7053efa11bbSBrian Somersconnections which do not open or close
7063efa11bbSBrian Somersproperly.
7073efa11bbSBrian Somers.Ss A.3 Partially Specified Aliasing Links
7083efa11bbSBrian SomersAliasing links can be partially specified,
7093efa11bbSBrian Somersmeaning that the remote address and/or remote
7103efa11bbSBrian Somersports are unkown.  In this case, when a packet
7113efa11bbSBrian Somersmatching the incomplete specification is found,
7123efa11bbSBrian Somersa fully specified dynamic link is created.  If
7133efa11bbSBrian Somersthe original partially specified link is dynamic,
7143efa11bbSBrian Somersit will be deleted after the fully specified link
7153efa11bbSBrian Somersis created, otherwise it will persist.
7163efa11bbSBrian Somers
7173efa11bbSBrian SomersFor instance, a partially specified link might
7183efa11bbSBrian Somersbe
7193efa11bbSBrian Somers.Bd -literal -offset indent
7203efa11bbSBrian Somers(192.168.0.4, 23, 204.228.203.215, 8066, 0, 0, tcp)
7213efa11bbSBrian Somers.Ed
7223efa11bbSBrian Somers
7233efa11bbSBrian SomersThe zeros denote unspecified components for
7243efa11bbSBrian Somersthe remote address and port.  If this link were
7253efa11bbSBrian Somersstatic it would have the effect of redirecting
7263efa11bbSBrian Somersall incoming traffic from port 8066 of
7273efa11bbSBrian Somers204.228.203.215 to port 23 (telnet) of machine
7283efa11bbSBrian Somers192.168.0.4 on the local network.  Each
7293efa11bbSBrian Somersindividual telnet connection would initiate
7303efa11bbSBrian Somersthe creation of a distinct dynamic link.
7313efa11bbSBrian Somers.Ss A.4 Dynamic Link Creation
7323efa11bbSBrian SomersIn addition to aliasing links, there are
7333efa11bbSBrian Somersalso address mappings that can be stored
7343efa11bbSBrian Somerswithin the internal data table of the packet
7353efa11bbSBrian Somersaliasing mechanism.
7363efa11bbSBrian Somers.Bd -literal -offset indent
7373efa11bbSBrian Somers(local addr, alias addr)
7383efa11bbSBrian Somers.Ed
7393efa11bbSBrian Somers
7403efa11bbSBrian SomersAddress mappings are searched when creating
7413efa11bbSBrian Somersnew dynamic links.
7423efa11bbSBrian Somers
7433efa11bbSBrian SomersAll outgoing packets from the local network
7443efa11bbSBrian Somersautomatically create a dynamic link if
7453efa11bbSBrian Somersthey do not match an already existing fully
7463efa11bbSBrian Somersspecified link.  If an address mapping exists
7473efa11bbSBrian Somersfor the the outgoing packet, this determines
7483efa11bbSBrian Somersthe alias address to be used.  If no mapping
7493efa11bbSBrian Somersexists, then a default address, usually the
7503efa11bbSBrian Somersaddress of the packet aliasing host, is used.
7513efa11bbSBrian SomersIf necessary, this default address can be
7523efa11bbSBrian Somerschanged as often as each indvidual packet
7533efa11bbSBrian Somersarrives.
7543efa11bbSBrian Somers
7553efa11bbSBrian SomersThe aliasing port number is determined
7563efa11bbSBrian Somerssuch that the new dynamic link does not
7573efa11bbSBrian Somersconflict with any existing links.  In the
7583efa11bbSBrian Somersdefault operating mode, the packet aliasing
7593efa11bbSBrian Somersengine attempts to set the aliasing port
7603efa11bbSBrian Somersequal to the local port number.  If this
7613efa11bbSBrian Somersresults in a conflict, then port numbers
7623efa11bbSBrian Somersare randomly chosen until a unique aliasing
7633efa11bbSBrian Somerslink can be established.  In an alternate
7643efa11bbSBrian Somersoperating mode, the first choice of an
7653efa11bbSBrian Somersaliasing port is also random and unrelated
7663efa11bbSBrian Somersto the local port number.
7673efa11bbSBrian Somers
768